Azure / Azure/azure-quickstart-templates
SAS token in template linked URL logged
- Dominant language
- Bicep
- Stars
- 14.9k
- Forks
- 16.2k
- Avg merge
- 6d 21h
- Merged PRs (30d)
- 6
Description
I use SAS tokens to deploy linked templates and keep the templates private. The full template URL (including the SAS token) ends up in the deployment log info. Please remove the SAS token query parameters from the log info. My secureString parameter should not end up in the logs!
Here is the template I am deploying
``` javascript
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0",
"parameters": {
"params": {
"type": "Object"
},
"_templateSasToken_": {
"type": "SecureString"
},
"_templateContainer_": {
"type": "String"
}
},
"variables": {},
"resources": [
{
"type": "Microsoft.Resources/deployments",
"name": "20160520-201610-template",
"apiVersion": "2016-02-01",
"properties": {
"templateLink": {
"uri": "[concat(parameters('_templateContainer_'), '1.0.0/template.json', parameters('_templateSasToken_'))]"
},
"parameters": {
"name": {
"value": "[parameters('params').name]"
},
"location": {
"value": "[parameters('params').location]"
}
},
"mode": "incremental"
}
}
]
}
```
Let me know if there is a more appropriate place to report issues like this in the future. Thanks!
Contributor guide
No contributing guide indexed for this repository
Research direction
No repository file, test, or entry point is named. Start by reproducing the Azure linked-template deployment with the supplied ARM template, inspect the deployment log entry containing the template URL, and consider the issue done when SAS query parameters and secure values no longer appear there.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100